> I'm not entirely sure how we start to fix this.

This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative...

Did Maersk recover from that ransomware attack two days ago?

I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention.

Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper:

https://blog.acolyer.org/2017/06/28/an-experimental-security...

I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...

> Did Maersk recover from that ransomware attack two days ago?

Somewhat-to-mostly, yes. http://gcaptain.com/maersk-operational-update-on-cyber-attac...

Still, it undoubtedly cost them a lot. The question is did it cost them more than the prevention would have?

You say of course, they only needed to be up-to-date on patches. But there's a cost to that, and we don't know that they don't insure (or self-insure) against IT disasters (they likely do, given their size and scope).

Isn't the problem in part that some people see "we done been hacked in our car making doohickey" (/cletus) and respond "backdoor all the things" thinking that allowing tougher security just let's the crackers hide whilst backdoors let the "feds" catch them.

I'm not even sure they're wrong per se. In theory (!!) a benevolent watchful government can promote liberty and protect its citizens (or in my case The Queen's subjects).

that is definitely a problem. But wouldn't backdoors only allow feds to catch cybercriminals after the act? Better security would prevent disasters in the first place. This seems to me a much better way of thinking about the issue

Not as comprehensive as I'd like, but there are standards and regulations. Part of the problem is that these are relatively "new", as far as power companies go.

http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx

Pieces like this should hopefully scare other companies into action. After all, it was conducted with permission from the wind farm companies. That they've hired pentesters indicate they are now working towards fixing the problems.

Its governments that need scaring. Industry will never self-regulate.